Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization (CVE-2026-44311) | HOL Guard CVE